feat(git): user-level hooks auto-dispatch into <repo>/.githooks/

Inverts the hook delegation model. Previously per-repo hooks required
a project to either (a) write the entire hook themselves and lose the
global signed-commit / agent-author gate, or (b) override
core.hooksPath and write passthrough stubs that exec back to
$HOME/.config/git/hooks/*. Both are ergonomically miserable.

Now: the global hooks at ~/.config/git/hooks/ are *always* the entry
point. Each one calls a shared dispatcher (_dispatch.sh) that runs
<repo>/.githooks/<hookname> if it exists, propagating its exit status,
and then continues with whatever the global hook itself wants to do.
Projects just drop an executable file at .githooks/<name> — no
core.hooksPath, no stubs, no boilerplate. Repos that don't have a
.githooks/ dir keep working exactly as before.

GIT_HOOK_DISPATCHED guards against re-entry so legacy repos using the
old stub-and-exec pattern don't loop. pre-push tees stdin so both the
repo hook and the global ref-list loop see the full push payload.

Adds two new always-no-op global hooks (pre-commit, post-commit)
purely so the dispatch happens for those events too — previously only
commit-msg and pre-push existed globally.

Refactors this dotfiles repo to use the new pattern: drops the
self-delegating .githooks/pre-push stub and removes the per-repo
core.hooksPath override from `just init` (now an idempotent unsetter
to clean up the override from past bootstraps). The remote-dev VM's
home-manager profile symlinks all four hooks plus _dispatch.sh.

1 files changed, 31 insertions, 0 deletions

diff --git a/dot_config/git/hooks/_dispatch.sh b/dot_config/git/hooks/_dispatch.sh
new file mode 100644
index 0000000..7dcd89c
--- /dev/null
+++ b/dot_config/git/hooks/_dispatch.sh
@@ -0,0 +1,31 @@
+#!/bin/sh
+# Sourced by every hook in this directory. Runs the per-repo hook of the
+# same name from `<repo-top>/.githooks/` if it exists, then returns
+# control so the calling user-level hook can do its own work after.
+#
+# Repos opt in by just dropping `.githooks/<hookname>` (executable) in
+# the working tree — no per-repo `core.hooksPath` setting, no stubs.
+# If the per-repo hook exits non-zero we abort with that status so git
+# sees the failure.
+#
+# GIT_HOOK_DISPATCHED guards against re-entry: if some legacy repo has
+# its own `.githooks/<hook>` that ends with `exec "$HOME/.config/..."`
+# (the old pattern), we won't dispatch back into it a second time.
+
+# shellcheck shell=sh
+dispatch_repo_hook() {
+  hookname=$1
+  shift
+
+  [ -n "${GIT_HOOK_DISPATCHED:-}" ] && return 0
+
+  root=$(git rev-parse --show-toplevel 2>/dev/null) || return 0
+  repo_hook="$root/.githooks/$hookname"
+  [ -x "$repo_hook" ] || return 0
+
+  GIT_HOOK_DISPATCHED=1 "$repo_hook" "$@"
+  rc=$?
+  if [ "$rc" -ne 0 ]; then
+    exit "$rc"
+  fi
+}